HAWK withdrawn from NIST PQC; CPython and Inetutils CVEs

A lattice attack on HAWK led to its withdrawal from NIST post-quantum signature standardization, while CPython and GNU Inetutils each received CVE disclosures. HQC authors also floated small parameter changes that drew process questions on the PQC forum.

HAWK withdrawn after dimension-halving lattice attack

Anthropic researchers presented an AI-assisted lattice attack showing that HAWK-n key recovery reduces to SVP in dimension n/2 + 1. The result halves the effective security dimension and prompted HAWK's official withdrawal from the NIST PQC signatures round. Teams evaluating post-quantum signature candidates should treat HAWK as out of that process.

CPython HTTPPasswordMgr sends credentials across schemes

CVE-2026-15806 affects CPython urllib.request.HTTPPasswordMgr, which could supply credentials registered for one URL scheme when contacting a host over another scheme. The fix scopes password-manager matching by scheme so http and https entries no longer cross. Code that stores mixed-scheme credentials in the standard library manager should pick up the update.

CPython stringprep drifts past Unicode 3.2.0

CVE-2026-17084 covers the CPython stringprep module consulting Unicode codepoint attributes beyond the Unicode 3.2.0 baseline required by RFC 3454 tables. The mismatch can alter IDNA 2003 domain handling. Deployments that prepare internationalized names with the stdlib module should apply the medium-severity fix.

Buffer overflow in GNU Inetutils talkd

GNU Inetutils talkd overflows a buffer when processing long reverse DNS names, disclosed as CVE-2026-19720 after coordinated handling. Hosts still running the talkd service face a remote overflow from crafted DNS data. Operators should patch or disable the daemon.

HQC authors propose small parameter tweaks

HQC authors posted modest parameter adjustments aimed at attack margin and anonymity properties. Daniel J. Bernstein and John Mattsson questioned the stability of the changes and their timing relative to NIST's schedule. Observers of code-based KEMs may want to track how the parameter discussion resolves.